TrojanSpy.MSIL.METASTEAL.A

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Verbindet sich mit einer bestimmten Website, um Daten zu versenden und zu empfangen.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Datendiebstahl

Folgende Daten werden gesammelt:

• Gathers the following system information:
  • Username
  • Domain Name
  • Serial Number
  • Screen Resolution
  • Operating System
  • GPU Information
  • CPU Information
  • IP Address
  • System Languages/Locales
  • System Timezone
  • Installed browsers
  • Installed programs
  • Installed visual studio
  • Running processes
  • Image base address
  • Execution path
• Gathers the following based on the configuration received from the server:
  • Cryptowallet information
  • Browser data
  • Files grabber
  • Environment variable data related to Tokens and Keys

Andere Details

Verbindet sich mit der folgenden Website, um Daten zu versenden und zu empfangen:

• tcp://{BLOCKED}.{BLOCKED}.{BLOCKED}.210:41944/

Es macht Folgendes:

• It deletes the following folder if creation date is greater than 14 days:
  • %AppDataLocal%\ElevatedDiagnostics
• It creates the following folder if not existing or was deleted based on the condition above:
  • %AppDataLocal%\ElevatedDiagnostics